Analysis

  • max time kernel
    136s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-06-2024 12:10

General

  • Target

    Material Attached.exe

  • Size

    983KB

  • MD5

    a7a11d7dc16fef60c09830725b1d70f5

  • SHA1

    c351ed457dd5855594b7def5804fbd785dfcb370

  • SHA256

    247231562ac357a1ccf0770b35d4bd7b140a98e677b1a31f825ba9d020e51eb0

  • SHA512

    054328aa10643e97b8b04e0190332d1a8b4dab3f7cd0116cb7cfff3145ef99e17fcccf2080586671483b5f942246f4d2d0e2c30633909231418f8008ed264cbe

  • SSDEEP

    12288:map8vZ89HTpiwVuWcWzDSVYFCVmKVa9FcxSPBk4mO/mKU6S+P4g0H6qx/gup+5Ac:m6kLwA7WzsnQSSPBPm+7hw7sejpLAtEg

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Material Attached.exe
    "C:\Users\Admin\AppData\Local\Temp\Material Attached.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Material Attached.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4292
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kDtrwbEktsDpCd.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4296
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kDtrwbEktsDpCd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA33.tmp"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3352
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:1228
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3768

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      0aa83a93781c39a58f0f4323db0b3bd9

      SHA1

      1d227818b583db26f58d042ad9428f73d11cc9f0

      SHA256

      861c4855f162b020a22faa5ec54baee54aa87f1c132cecaad145fd50573ed001

      SHA512

      b584964d17973a3a6893c0738fcd79cf66b2add7949409619b6573f5522bd801a3b983e555eba22ea93c78365d69409ad96618aaecd24598412c4fd18310f6cd

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q21rfnsh.n3d.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpDA33.tmp

      Filesize

      1KB

      MD5

      3c529f40835665622a2a05de90345d2d

      SHA1

      b31a4c3b17f14cdb73148328bbe96e009d766722

      SHA256

      9fae04574a0407954b989adf0b982b8ffe498fd2789466ac990c2ee651473aff

      SHA512

      adc01db08e9a869df5fa8954e8d349651b750185fe99f2607e07f8c9c49d2856e89a7d62980af85e93c3cc0d7a7d494e427c0fe0ed610dbcd1e75ee1263a5755

    • memory/1852-5-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB

    • memory/1852-52-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB

    • memory/1852-6-0x00000000058A0000-0x000000000593C000-memory.dmp

      Filesize

      624KB

    • memory/1852-7-0x0000000006840000-0x0000000006D6C000-memory.dmp

      Filesize

      5.2MB

    • memory/1852-8-0x0000000005D50000-0x0000000005D62000-memory.dmp

      Filesize

      72KB

    • memory/1852-9-0x0000000006800000-0x0000000006808000-memory.dmp

      Filesize

      32KB

    • memory/1852-10-0x0000000006810000-0x000000000681C000-memory.dmp

      Filesize

      48KB

    • memory/1852-11-0x00000000092B0000-0x0000000009346000-memory.dmp

      Filesize

      600KB

    • memory/1852-12-0x0000000009840000-0x00000000098C4000-memory.dmp

      Filesize

      528KB

    • memory/1852-44-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB

    • memory/1852-3-0x0000000005640000-0x00000000056D2000-memory.dmp

      Filesize

      584KB

    • memory/1852-2-0x0000000005D60000-0x0000000006304000-memory.dmp

      Filesize

      5.6MB

    • memory/1852-18-0x00000000745BE000-0x00000000745BF000-memory.dmp

      Filesize

      4KB

    • memory/1852-4-0x00000000031E0000-0x00000000031EA000-memory.dmp

      Filesize

      40KB

    • memory/1852-1-0x0000000000B50000-0x0000000000C48000-memory.dmp

      Filesize

      992KB

    • memory/1852-0-0x00000000745BE000-0x00000000745BF000-memory.dmp

      Filesize

      4KB

    • memory/3768-50-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/3768-95-0x0000000006CC0000-0x0000000006D10000-memory.dmp

      Filesize

      320KB

    • memory/4292-43-0x0000000005600000-0x0000000005954000-memory.dmp

      Filesize

      3.3MB

    • memory/4292-22-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB

    • memory/4292-30-0x0000000005520000-0x0000000005586000-memory.dmp

      Filesize

      408KB

    • memory/4292-17-0x0000000002280000-0x00000000022B6000-memory.dmp

      Filesize

      216KB

    • memory/4292-94-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB

    • memory/4292-21-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB

    • memory/4292-19-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB

    • memory/4292-78-0x0000000007570000-0x0000000007BEA000-memory.dmp

      Filesize

      6.5MB

    • memory/4292-29-0x0000000005480000-0x00000000054A2000-memory.dmp

      Filesize

      136KB

    • memory/4292-20-0x0000000004E00000-0x0000000005428000-memory.dmp

      Filesize

      6.2MB

    • memory/4292-87-0x0000000007240000-0x0000000007248000-memory.dmp

      Filesize

      32KB

    • memory/4292-82-0x0000000007120000-0x0000000007131000-memory.dmp

      Filesize

      68KB

    • memory/4292-80-0x0000000006F90000-0x0000000006F9A000-memory.dmp

      Filesize

      40KB

    • memory/4292-67-0x0000000074E60000-0x0000000074EAC000-memory.dmp

      Filesize

      304KB

    • memory/4292-79-0x0000000006F20000-0x0000000006F3A000-memory.dmp

      Filesize

      104KB

    • memory/4292-31-0x0000000005590000-0x00000000055F6000-memory.dmp

      Filesize

      408KB

    • memory/4296-56-0x0000000074E60000-0x0000000074EAC000-memory.dmp

      Filesize

      304KB

    • memory/4296-77-0x0000000006F00000-0x0000000006FA3000-memory.dmp

      Filesize

      652KB

    • memory/4296-66-0x0000000006C80000-0x0000000006C9E000-memory.dmp

      Filesize

      120KB

    • memory/4296-81-0x0000000007270000-0x0000000007306000-memory.dmp

      Filesize

      600KB

    • memory/4296-55-0x0000000006CC0000-0x0000000006CF2000-memory.dmp

      Filesize

      200KB

    • memory/4296-84-0x0000000007220000-0x000000000722E000-memory.dmp

      Filesize

      56KB

    • memory/4296-85-0x0000000007230000-0x0000000007244000-memory.dmp

      Filesize

      80KB

    • memory/4296-86-0x0000000007330000-0x000000000734A000-memory.dmp

      Filesize

      104KB

    • memory/4296-54-0x0000000005D10000-0x0000000005D5C000-memory.dmp

      Filesize

      304KB

    • memory/4296-53-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

      Filesize

      120KB

    • memory/4296-38-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB

    • memory/4296-49-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB

    • memory/4296-93-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB

    • memory/4296-23-0x00000000745B0000-0x0000000074D60000-memory.dmp

      Filesize

      7.7MB